17114db832878c689184db3a98dd4630_JaffaCakes118

General

Target
17114db832878c689184db3a98dd4630_JaffaCakes118
Size 552KB
Sample241005-k5sefsxbkr
SHA256 358c11cf468efa01a1d40ad0042857d05bf27b3799895b34a28a35628ca75137
MD5 17114db832878c689184db3a98dd4630
SHA1 adaf2d95f35bcb17643aea750ac7c9d0e10cde80
SHA512 cdd8e52b8d377b750a1cfb03fff092cf374159a050b6d166370650ba2377901826f758ace6f367430a21d284afe0ab8ff482833781c104542eee6008db500181
SSDEEP 12288:wehnaNPpSVZmNxRCwnwm3W3OHIIf5dafoH3XHYsNJO463:weh0PpS6NxNnwYeOHXHCq3XYcO
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17114db832878c689184db3a98dd4630_JaffaCakes118

File Explorer

17114db832878c689184db3a98dd4630_JaffaCakes118

.dll 552KB

17114db832878c689184db3a98dd4630_JaffaCakes118

IMPHASH a24bdda400a413aa6d759d0b8e02ddd9
SHA256 358c11cf468efa01a1d40ad0042857d05bf27b3799895b34a28a35628ca75137
MD5 17114db832878c689184db3a98dd4630
SHA1 adaf2d95f35bcb17643aea750ac7c9d0e10cde80
SHA512 cdd8e52b8d377b750a1cfb03fff092cf374159a050b6d166370650ba2377901826f758ace6f367430a21d284afe0ab8ff482833781c104542eee6008db500181
SSDEEP 12288:wehnaNPpSVZmNxRCwnwm3W3OHIIf5dafoH3XHYsNJO463:weh0PpS6NxNnwYeOHXHCq3XYcO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

397312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GlobalMemoryStatus QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetCurrentProcessId TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree HeapAlloc InterlockedIncrement InterlockedDecrement HeapReAlloc GetCurrentThreadId GetCommandLineA GetVersionExA GetProcessHeap RaiseException RtlUnwind GetProcAddress GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapDestroy HeapCreate VirtualFree VirtualAlloc ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP WideCharToMultiByte GetTimeZoneInformation Sleep GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale IsValidCodePage GetStringTypeA MultiByteToWideChar GetStringTypeW SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetFilePointer GetConsoleCP GetConsoleMode LoadLibraryA LCMapStringA LCMapStringW GetLocaleInfoW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapSize CreateFileA CloseHandle FlushFileBuffers CompareStringA CompareStringW SetEnvironmentVariableA

WXMPIterator_DecrementRefCount_1 WXMPIterator_IncrementRefCount_1 WXMPIterator_Next_1 WXMPIterator_PropCTor_1 WXMPIterator_Skip_1 WXMPIterator_TableCTor_1 WXMPIterator_Unlock_1 WXMPMeta_AppendArrayItem_1 WXMPMeta_CTor_1 WXMPMeta_Clone_1 WXMPMeta_CountArrayItems_1 WXMPMeta_DecrementRefCount_1 WXMPMeta_DeleteAlias_1 WXMPMeta_DeleteArrayItem_1 WXMPMeta_DeleteNamespace_1 WXMPMeta_DeleteProperty_1 WXMPMeta_DeleteQualifier_1 WXMPMeta_DeleteStructField_1 WXMPMeta_DoesArrayItemExist_1 WXMPMeta_DoesPropertyExist_1 WXMPMeta_DoesQualifierExist_1 WXMPMeta_DoesStructFieldExist_1 WXMPMeta_DumpAliases_1 WXMPMeta_DumpNamespaces_1 WXMPMeta_DumpObject_1 WXMPMeta_DumpPropertyTraits_1 WXMPMeta_GetArrayItem_1 WXMPMeta_GetGlobalOptions_1 WXMPMeta_GetLocalizedText_1 WXMPMeta_GetMemProcs_1 WXMPMeta_GetNamespacePrefix_1 WXMPMeta_GetNamespaceURI_1 WXMPMeta_GetObjectName_1 WXMPMeta_GetObjectOptions_1 WXMPMeta_GetProperty_1 WXMPMeta_GetProperty_Bool_1 WXMPMeta_GetProperty_Date_1 WXMPMeta_GetProperty_Float_1 WXMPMeta_GetProperty_Int64_1 WXMPMeta_GetProperty_Int_1 WXMPMeta_GetQualifier_1 WXMPMeta_GetStructField_1 WXMPMeta_GetVersionInfo_1 WXMPMeta_IncrementRefCount_1 WXMPMeta_Initialize_1 WXMPMeta_MarkStaleProperties_1 WXMPMeta_ParseFromBuffer_1 WXMPMeta_RegisterAlias_1 WXMPMeta_RegisterAssertNotify_1 WXMPMeta_RegisterNamespace_1 WXMPMeta_RegisterPropertyTraits_1 WXMPMeta_RegisterStandardAliases_1 WXMPMeta_ResolveAlias_1 WXMPMeta_SendAssertNotify_1 WXMPMeta_SerializeToBuffer_1 WXMPMeta_SetArrayItem_1 WXMPMeta_SetGlobalOptions_1 WXMPMeta_SetLocalizedText_1 WXMPMeta_SetObjectName_1 WXMPMeta_SetObjectOptions_1 WXMPMeta_SetProperty_1 WXMPMeta_SetProperty_Bool_1 WXMPMeta_SetProperty_Date_1 WXMPMeta_SetProperty_Float_1 WXMPMeta_SetProperty_Int64_1 WXMPMeta_SetProperty_Int_1 WXMPMeta_SetQualifier_1 WXMPMeta_SetStructField_1 WXMPMeta_Terminate_1 WXMPMeta_UnlockObject_1 WXMPMeta_Unlock_1 WXMPMeta_UnregisterAssertNotify_1 WXMPUtils_AddEmbeddedDocument_1 WXMPUtils_AppendProperties_1 WXMPUtils_CatenateArrayItems_1 WXMPUtils_ClearManifest_1 WXMPUtils_CollectMultiFileXMP_1 WXMPUtils_CompareDateTime_1 WXMPUtils_ComposeArrayItemPath_1 WXMPUtils_ComposeFieldSelector_1 WXMPUtils_ComposeLangSelector_1 WXMPUtils_ComposeQualifierPath_1 WXMPUtils_ComposeStructFieldPath_1 WXMPUtils_ConvertFromBool_1 WXMPUtils_ConvertFromDate_1 WXMPUtils_ConvertFromFloat_1 WXMPUtils_ConvertFromInt64_1 WXMPUtils_ConvertFromInt_1 WXMPUtils_ConvertToBool_1 WXMPUtils_ConvertToDate_1 WXMPUtils_ConvertToFloat_1 WXMPUtils_ConvertToInt64_1 WXMPUtils_ConvertToInt_1 WXMPUtils_ConvertToLocalTime_1 WXMPUtils_ConvertToUTCTime_1 WXMPUtils_CurrentDateTime_1 WXMPUtils_DecodeFromBase64_1 WXMPUtils_DistributeMultiFileXMP_1 WXMPUtils_DuplicateSubtree_1 WXMPUtils_EncodeToBase64_1 WXMPUtils_GetDateRange_1 WXMPUtils_GetMergedListPath_1 WXMPUtils_HasContainedDoc_1 WXMPUtils_InitializeDerivedDocument_1 WXMPUtils_InitializeNewDocument_1 WXMPUtils_IsPropertyMultiValued_1 WXMPUtils_MergeFromJPEG_1 WXMPUtils_OpenWorkingDocument_1 WXMPUtils_PackageForJPEG_1 WXMPUtils_RemoveEmbeddedDocument_1 WXMPUtils_RemoveMultiValueInfo_1 WXMPUtils_RemoveProperties_1 WXMPUtils_SaveWorkingDocument_1 WXMPUtils_SeparateArrayItems_1 WXMPUtils_SetAppName_1 WXMPUtils_SetMIMEMapping_1 WXMPUtils_SetTimeZone_1 WXMPUtils_UnlockIter_1 WXMPUtils_Unlock_1 WXMPUtils_UpdateEmbeddedDocument_1

Name

.text

Size

276KB

Virtual Size

273KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

68KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

20KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

172KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

17114db832878c689184db3a98dd4630_JaffaCakes118

kernel32

generic